Security audit

Cn Web Search 2.2.0

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed web-search helper that sends search terms to listed search engines; no hidden code, persistence, or destructive behavior was found.

Install only if you want an agent to perform web searches through the listed third-party search engines. Do not use it for confidential names, credentials, unreleased business plans, or other sensitive search terms unless you are comfortable sharing those terms with external search providers.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: The README presents the skill entirely in Chinese and all invocation examples are Chinese-only, with no indication that users may choose another language or locale. This can be interpreted as enforcing a specific language experience without explicit opt-in or a documented region-specific justification.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The example trigger phrase is very broad and resembles normal conversational input, which can cause the skill to activate unintentionally during unrelated user requests. In an agent environment, overbroad invocation increases the chance of unwanted web scraping/search actions and can interfere with routing to other, more appropriate skills.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly directs the agent to send user-provided search queries to numerous third-party search engines via web_fetch, but it does not disclose that those queries will be transmitted off-platform. This can expose sensitive user inputs, research topics, financial interests, or proprietary terms to external providers and create privacy/compliance risk, especially because the skill encourages broad use across many engines.

Natural-Language Policy Violations

Low

Confidence: 76% confidence
Finding: The manifest description specifies the skill as `中文网页搜索` and frames it as a Chinese web search capability. Under the policy, language or locale constraints should either offer user choice or clearly document a justified regional limitation; this file does not do so.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The natural-language description is written entirely in Chinese and presents the skill as a Chinese web search tool without indicating that users can choose another language or locale. Under the stated policy, forcing a specific language or locale without opt-in is a reportable natural-language policy concern.

Static analysis

No suspicious patterns detected.